1395211 - Crash in MessageLoop::PostTask_Helper (on Windows)

Status: RESOLVED DUPLICATE of bug 1398070

(Core :: IPC, defect, P2)

Description

[Randell Jesup [:jesup] (needinfo me)]

+++ This bug was initially created as a clone of Bug #1394788 +++

Note this is for non-android crashes with this signature, which have a different cause it appears.  

This is a frequent clear UAF/random-ptr crash on windows.

https://crash-stats.mozilla.com/signature/?platform=%21Android&signature=MessageLoop%3A%3APostTask_Helper&date=%3E%3D2017-08-23T15%3A28%3A00.000Z&date=%3C2017-08-30T15%3A28%3A00.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-date&page=1#reports

For example: https://crash-stats.mozilla.com/report/index/b0cd0453-e282-4113-a985-e335f0170830 and https://crash-stats.mozilla.com/report/index/7b1010f2-dea2-452c-afd3-73caa0170830

50-ish each are  called from MessageChannel::OnChannelErrorFromLink()/PostErrorNotifyTask()
450ish are called from OnMessageReceivedFromLink()

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

It's pretty likely that these are cases where a thread is being shut down while there is still an IPC channel directing messages to it. We need to figure out which IPC channel is involved and fix it. The assertions in bug 1349699 were meant to help figure that out, but they ended up increasing the crash rate and so I backed one of them out. Bug 1395330 will re-enable the assertion. That's pretty much all I can do to help here.

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Also, isn't this is a dupe of bug 1320771?

Comment 3

[Andrew McCreight [:mccr8]]

Yeah, most of the cases I saw with poison values were in xpcom shutdown.

Comment 4

[Randell Jesup [:jesup] (needinfo me)]

(In reply to Bill McCloskey (:billm) from comment #2)
> Also, isn't this is a dupe of bug 1320771?

Likely it is... ETOOMANYSIGNATURES

Though it's useful to point out it's still with us, even if temporarily hidden under a zillion android crashes

Comment 5

[Wennie]

Bill, please investigate and fix these bugs or assign them to appropriate developers. Thanks!

Comment 6

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I'm going to close this. The remaining crashes with the PostTask_Helper signature all appear to be gfx-related. I filed bug 1413011 for those.